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DETAILED ACTION 

1 . Page 3 of applicant's Oath/Declaration claims a foreign priority. However, no 
certified copy has been found on the record. 

2. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

Claims 13-18 rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. As to claims 13-18 are directed to a computer 
program loadable into a policy decision device. Therefore, the claims 13-18 are 
directed to program per se, therefore, non-statutory. 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

Claims 1-18, rejected under 35 U.S.C. 102(b) as being anticipated by Cline et al 
(US 5,313,616). 

As to claim 1, Cline discloses a method for taking a policy decision (see 
analyzing and verifying in column 1 1 lines 22-24, figure 7) by a policy decision device 
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(SBV program, see in column 1 1 lines 22-24, figure 7), wherein the policy decision 
device (SBV program, see in column 1 1 lines 22-24, figure 7) has access to objects 
(see the object code of an application in figure 2 [18, column 6 lines 15-21) being 
relatable to each other by relations (see the set of system compatibility rules including 
BSC and OCS in column 4 lines 36-42, figure 1 [10]) of one or more relation types (see 
system and library calls in column 1 1 lines 23), the method comprising the steps of 
receiving a request (see basic blocks in figure 7 [38]) for the policy decision (see 
analyzing and verifying in column 1 1 lines 22-24, figure 7), the request (see basic 
blocks in figure 7 [38]) specifying a first object (see the object code of an application in 
figure 2 [18, column 6 lines 15-21) of the and request information (see basic blocks in 
figure 7 [38]), obtaining a policy (see a set of rules analyze the call based on the format 
of the application being analyzed; column 9 lines 4-11, figure 5) matching to the request 
information (see basic blocks in figure 7 [38]) and being applicable to a second object 
(see the object code of an application in figure 2 [18, column 6 lines 15-21) of the 
objects (see the object code of an application in figure 2 [18, column 6 lines 15-21), 
obtaining at least one propagation rule (see a set of rules analyze the call based on the 
format of the application being analyzed; column 9 lines 4-11, figure 5) associated to the 
policy (see a set of rules analyze the call based on the format of the application being 
analyzed; column 9 lines 4-1 1 , figure 5), the at least one propagation rule (see a set of 
rules analyze the call based on the format of the application being analyzed; column 9 
lines 4-1 1 , figure 5) specifying at least one relation type (see system and library calls in 
column 1 1 lines 23) of the one or more relation types (see system and library calls in 
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column 1 1 lines 23), verifying (see analyzing and verifying in column 1 1 lines 22-24, 
figure 7) if a relation path (see a unique path in column 14 lines 9-10) exits, the relation 
path (see a unique path in column 14 lines 9-10) linking the first object (see the object 
code (see the object code of an application in figure 2 [1 8, column 6 lines 1 5-21 ) of an 
application in figure 2 [18, column 6 lines 15-21) and the second object (see the object 
code of an application in figure 2 [18, column 6 lines 15-21) and consisting of one or 
more of the relations (see the set of system compatibility rules including BSC and OCS 
in column 4 lines 36-42, figure 1 [10]), verifying (see analyzing and verifying in column 
1 1 lines 22-24, figure 7) if the one or more relations (see the set of system compatibility 
rules including BSC and OCS in column 4 lines 36-42, figure 1 [10]) of the relation path 
(see a unique path in column 1 4 lines 9-1 0) are in accordance with at least one of the at 
least one specified relation type (see system and library calls in column 1 1 lines 23), 
and if said relation path (see a unique path in column 14 lines 9-10) exists and if said 
one or more relations (see the set of system compatibility rules including BSC and OCS 
in column 4 lines 36-42, figure 1 [10]) of the relation path (see a unique path in column 
14 lines 9-10) are in accordance, applying the policy (see a set of rules analyze the call 
based on the format of the application being analyzed; column 9 lines 4-1 1 , figure 5) to 
the first object (see the object code of an application in figure 2 [18, column 6 lines 15- 
21 ) for taking the policy decision (see analyzing and verifying in column 1 1 lines 22-24, 
figure 7). 
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As to claim 2, Cline teaches the method according to claim 1 , wherein the at 
least one propagation rule (see a set of rules analyze the call based on the format of the 
application being analyzed; column 9 lines 4-1 1 , figure 5) specifies at least one direction 
(see procedure calls in column 9 lines 15-19) and the method further comprises the step 
of verifying (see analyzing and verifying in column 11 lines 22-24, figure 7) if the one or 
more relations (see the set of system compatibility rules including BSC and OCS in 
column 4 lines 36-42, figure 1 [10]) of the relation path (see a unique path in column 14 
lines 9-10) are in accordance with the at least one specified direction(see procedure 
calls in column 9 lines 15-19) . 

As to claim 3, Cline teaches The method according to claim 1 , wherein the at 
least one propagation rule (see a set of rules analyze the call based on the format of the 
application being analyzed; column 9 lines 4-1 1 , figure 5) specifies at least one 
condition that is verified (see analyzing and verifying in column 1 1 lines 22-24, figure 7) 
for at least one of the objects (see the object code of an application in figure 2 [18, 
column 6 lines 15-21) of the relation (see a unique path in column 1 4 lines 9-1 0). 

As to claim 4, Cline teaches the method according to claim 1 , wherein the 
existence of the relation path (see a unique path in column 14 lines 9-10) is considered 
for obtaining of the policy (see a set of rules analyze the call based on the format of the 
application being analyzed; column 9 lines 4-1 1 , figure 5). 
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As to claim 5, Cline teaches the method according to claim 1 , wherein the at 
least one propagation rule (see a set of rules analyze the call based on the format of the 
application being analyzed; column 9 lines 4-1 1 , figure 5) is obtained from at least one 
propagation rule database (see a set of rules analyze the call based on the format of the 
application being analyzed; column 9 lines 4-1 1 , figure 5) on the basis of at least one 
reference identifier (see "open addressing" hash table in column 9 lines 15-19) 
associated to the at least one propagation rule (see a set of rules analyze the call based 
on the format of the application being analyzed; column 9 lines 4-1 1 , figure 5) and the 
policy (see a set of rules analyze the call based on the format of the application being 
analyzed; column 9 lines 4-1 1 , figure 5). 

As to claim 6, Cline teaches The method according to claim 1, wherein at least 
one further policy component (see a set of rules analyze the call based on the format of 
the application being analyzed; column 9 lines 4-1 1 , figure 5) of the policy (see a set of 
rules analyze the call based on the format of the application being analyzed; column 9 
lines 4-1 1 , figure 5) is obtained from at least one policy component database (see a set 
of rules analyze the call based on the format of the application being analyzed; column 
9 lines 4-1 1 , figure 5) based on at least one reference identifier (see "open addressing" 
hash table in column 9 lines 15-19) associated to the at least one further policy (see a 
set of rules analyze the call based on the format of the application being analyzed; 
column 9 lines 4-1 1 , figure 5) component and the policy (see a set of rules analyze the 
call based on the format of the application being analyzed; column 9 lines 4-1 1 , figure 
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As to claim 7, Cline teaches A policy decision device (SBV program, see in 
column 1 1 lines 22-24, figure 7) for taking a policy decision (see analyzing and verifying 
in column 1 1 lines 22-24, figure 7), the policy decision device (SBV program, see in 
column 1 1 lines 22-24, figure 7) comprising: a receiving unit (see the object reader 
OMODMGR.C in column 10 lines 42- 43) and a processing unit (see the block analyzer 
PROCBLK.C in column 10 lines 66-68, column 11 lines 1-2) wherein the processing unit 
(see the block analyzer PROCBLK.C in column 10 lines 66-68, column 1 1 lines 1-2) is 
adapted to access objects (see the object code of an application in figure 2 [18, column 
6 lines 15-21) being relatable to each other by relations (see the set of system 
compatibility rules including BSC and OCS in column 4 lines 36-42, figure 1 [10]) of one 
or more relation types (see system and library calls in column 1 1 lines 23), the receiving 
unit (see the object reader OMODMGR.C in column 10 lines 42- 43) is adapted to 
receive a request (see basic blocks in figure 7 [38]) for the policy decision (see 
analyzing and verifying in column 1 1 lines 22-24, figure 7), the request (see basic 
blocks in figure 7 [38]) specifying a first object (see the object code of an application in 
figure 2 [18, column 6 lines 15-21) of the objects (see the object code of an application 
in figure 2 [18, column 6 lines 15-21) and request (see basic blocks in figure 7 [38]) 
information, the processing unit (see the block analyzer PROCBLK.C in column 10 lines 
66-68, column 1 1 lines 1-2) is further adapted to obtain a policy (see a set of rules 
analyze the call based on the format of the application being analyzed; column 9 lines 
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4-1 1 , figure 5) matching to the request (see basic blocks in figure 7 [38]) information 
and being applicable to a second object (see the object code of an application in figure 
2 [18, column 6 lines 15-21) of the objects (see the object code of an application in 
figure 2 [18, column 6 lines 15-21), to obtain at least one propagation rule (see a set of 
rules analyze the call based on the format of the application being analyzed; column 9 
lines 4-1 1 , figure 5) associated to the policy (see a set of rules analyze the call based 
on the format of the application being analyzed; column 9 lines 4-11, figure 5), the at 
least one propagation rule (see a set of rules analyze the call based on the format of the 
application being analyzed; column 9 lines 4-1 1 , figure 5) specifying at least one relation 
type (see system and library calls in column 1 1 lines 23) of the one or more relation 
types (see system and library calls in column 1 1 lines 23), to verify if a relation path (see 
a unique path in column 14 lines 9-10) exits, the relation path (see a unique path in 
column 14 lines 9-10) linking the first object (see the object code of an application in 
figure 2 [18, column 6 lines 15-21 ) and the second object (see the object code of an 
application in figure 2 [18, column 6 lines 15-21) and consisting of one or more of the 
relations (see the set of system compatibility rules including BSC and OCS in column 4 
lines 36-42, figure 1 [1 0]), to verify if the one or more relations (see the set of system 
compatibility rules including BSC and OCS in column 4 lines 36-42, figure 1 [10]) of the 
relation path (see a unique path in column 14 lines 9-10) are in accordance with at least 
one of the at least one specified relation type (see system and library calls in column 1 1 
lines 23), and if said relation path (see a unique path in column 14 lines 9-10) exists and 
if said one or more relations (see the set of system compatibility rules including BSC 
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and OCS in column 4 lines 36-42, figure 1 [10]) of the relation path (see a unique path 
in column 14 lines 9-10) are in accordance, to apply the policy (see a set of rules 
analyze the call based on the format of the application being analyzed; column 9 lines 
4-1 1 , figure 5) to the first object (see the object code of an application in figure 2 [1 8, 
column 6 lines 15-21) for taking the policy decision (see analyzing and verifying in 
column 1 1 lines 22-24, figure 7). 

As to claim 8, Cline teaches the policy decision device (SBV program, see in 
column 1 1 lines 22-24, figure 7) according to claim 7, wherein the at least one 
propagation rule (see a set of rules analyze the call based on the format of the 
application being analyzed; column 9 lines 4-1 1 , figure 5) specifies at least one 
direction(see procedure calls in column 9 lines 15-19) and the processing unit (see the 
block analyzer PROCBLK.C in column 10 lines 66-68, column 1 1 lines 1-2) is adapted 
to verify if the one or more relations (see the set of system compatibility rules including 
BSC and OCS in column 4 lines 36-42, figure 1 [10]) of the relation path (see a unique 
path in column 14 lines 9-10) are in accordance with the at least one specified 
direction(see procedure calls in column 9 lines 15-19) . 

As to claim 9, Cline teaches The policy decision device (SBV program, see in 
column 1 1 lines 22-24, figure 7) according to claim 7, wherein the at least one 
propagation rule (see a set of rules analyze the call based on the format of the 
application being analyzed; column 9 lines 4-1 1 , figure 5) specifies at least one 
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condition and the processing unit (see the block analyzer PROCBLK.C in column 10 
lines 66-68, column 1 1 lines 1 -2) is adapted to verify, for at least one of the objects (see 
the object code of an application in figure 2 [18, column 6 lines 15-21) of the relation 
path (see a unique path in column 14 lines 9-10), if said at least one object (see the 
object code of an application in figure 2 [18, column 6 lines 15-21) is in accordance with 
the at least one condition. 

As to claim 10, Cline teaches the policy decision device (SBV program, see in 
column 1 1 lines 22-24, figure 7) according to claim 7, wherein the processing unit (see 
the block analyzer PROCBLK.C in column 10 lines 66-68, column 1 1 lines 1-2) is 
adapted to consider the existence of the relation path (see a unique path in column 14 
lines 9-10) for the obtaining of the policy (see a set of rules analyze the call based on 
the format of the application being analyzed; column 9 lines 4-1 1 , figure 5). 

As to claim 1 1 , Cline teaches the policy decision device (SBV program, see in 
column 1 1 lines 22-24, figure 7) according to claim 7, wherein the processing unit (see 
the block analyzer PROCBLK.C in column 10 lines 66-68, column 1 1 lines 1-2) is 
adapted to obtain the at least one propagation rule (see a set of rules analyze the call 
based on the format of the application being analyzed; column 9 lines 4-1 1 , figure 5) 
from at least one propagation rule (see a set of rules analyze the call based on the 
format of the application being analyzed; column 9 lines 4-1 1 , figure 5) database on the 
basis of at least one reference identifier (see "open addressing" hash table in column 9 
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lines 15-19) associated to the at least one propagation rule (see a set of rules analyze 
the call based on the format of the application being analyzed; column 9 lines 4-1 1 , 
figure 5) and the policy (see a set of rules analyze the call based on the format of the 
application being analyzed; column 9 lines 4-1 1 , figure 5). 

As to claim 12, Cline teaches the policy decision device (SBV program, see in 
column 1 1 lines 22-24, figure 7) according to claim 7, wherein the processing unit (see 
the block analyzer PROCBLK.C in column 10 lines 66-68, column 1 1 lines 1-2) is 
adapted to obtain at least one further policy component (see a set of rules analyze the 
call based on the format of the application being analyzed; column 9 lines 4-1 1 , figure 5) 
of the policy (see a set of rules analyze the call based on the format of the application 
being analyzed; column 9 lines 4-1 1 , figure 5) from the at least one policy component 
database (see a set of rules analyze the call based on the format of the application 
being analyzed; column 9 lines 4-1 1 , figure 5) based on at least one reference identifier 
(see "open addressing" hash table in column 9 lines 15-19) associated to the at least 
one further policy component (see a set of rules analyze the call based on the format of 
the application being analyzed; column 9 lines 4-1 1 , figure 5) and the policy (see a set 
of rules analyze the call based on the format of the application being analyzed; column 
9 lines 4-11, figure 5). 

As to claim 13, Cline teaches a computer program (see application program in 
column 2 lines 58-61, column 3 lines 41-42) loadable into a policy decision device (SBV 
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program, see in column 1 1 lines 22-24, figure 7), the computer program (see application 
program in column 2 lines 58-61, column 3 lines 41-42) comprising code adapted to 
access objects (see the object code of an application in figure 2 [18, column 6 lines 15- 
21) being relatable to each other by relations (see the set of system compatibility rules 
including BSC and OCS in column 4 lines 36-42, figure 1 [10]) of one or more relation 
types (see library calls in column 1 1 lines 23), to process a request (see basic blocks in 
figure 7 [38]) for a policy decision (see analyzing and verifying in column 1 1 lines 22-24, 
figure 7), the request (see basic blocks in figure 7 [38]) specifying a first object (see the 
object code of an application in figure 2 [18, column 6 lines 15-21) of the objects (see 
the object code of an application in figure 2 [18, column 6 lines 15-21) and request 
information (see basic blocks in figure 7 [38]), to obtain a policy (see a set of rules 
analyze the call based on the format of the application being analyzed; column 9 lines 
4-1 1 , figure 5) matching to the request information (see basic blocks in figure 7 [38]) 
and being applicable to a second object (see the object code of an application in figure 
2 [18, column 6 lines 15-21) of the objects (see the object code of an application in 
figure 2 [18, column 6 lines 15-21), to obtain at least one propagation rule (see a set of 
rules analyze the call based on the format of the application being analyzed; column 9 
lines 4-1 1 , figure 5) associated to the policy (see a set of rules analyze the call based 
on the format of the application being analyzed; column 9 lines 4-1 1 , figure 5), the at 
least one propagation rule (see a set of rules analyze the call based on the format of the 
application being analyzed; column 9 lines 4-1 1 , figure 5) specifying at least one relation 
type (see system and library calls in column 1 1 lines 23) of the one or more relation 
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types ((see system and library calls in column 1 1 lines 23), to verify if a relation path 
(see a unique path in column 14 lines 9-10) exits, the relation path (see a unique path in 
column 1 4 lines 9-1 0) linking the first object (see the object code of an application in 
figure 2 [18, column 6 lines 15-21 ) and the second object (see the object code of an 
application in figure 2 [18, column 6 lines 15-21) and consisting of one or more of the 
relations (see the set of system compatibility rules including BSC and OCS in column 4 
lines 36-42, figure 1 [1 0]), to verify if the one or more relations (see the set of system 
compatibility rules including BSC and OCS in column 4 lines 36-42, figure 1 [10]) of the 
relation path (see a unique path in column 14 lines 9-10) are in accordance with at least 
one of the at least one specified relation type (see system and library calls in column 1 1 
lines 23), and if said relation path (see a unique path in column 14 lines 9-10) exists and 
if said one or more relations (see the set of system compatibility rules including BSC 
and OCS in column 4 lines 36-42, figure 1 [10]) of the relation path (see a unique path 
in column 14 lines 9-10) are in accordance, to apply the policy (see a set of rules 
analyze the call based on the format of the application being analyzed; column 9 lines 
4-1 1 , figure 5) to the first object (see the object code of an application in figure 2 [18, 
column 6 lines 15-21) for taking the policy decision (see analyzing and verifying in 
column 1 1 lines 22-24, figure 7). 

As to claim 14, Cline teaches the computer program (see application program in 
column 2 lines 58-61, column 3 lines 41-42) according to claim 13, wherein the at least 
one propagation rule (see a set of rules analyze the call based on the format of the 



Application/Control Number: 99/123,457 Page 14 

Art Unit: 4171 

application being analyzed; column 9 lines 4-1 1 , figure 5) specifies at least one direction 
(see procedure calls in column 9 lines 15-19) and the computer program (see 
application program in column 2 lines 58-61, column 3 lines 41-42) comprises code (see 
the object code of an application in figure 2 [18, column 6 lines 15-21) adapted to verify 
if the one or more relations (see the set of system compatibility rules including BSC and 
OCS in column 4 lines 36-42, figure 1 [10]) of the relation path (see a unique path in 
column 14 lines 9-10) are in accordance with the at least one specified direction (see 
procedure calls in column 9 lines 15-19). 

As to claim 15, Cline teaches the computer program (see application program in 
column 2 lines 58-61 , column 3 lines 41 -42) according to claim 1 3, wherein the at least 
one propagation rule (see a set of rules analyze the call based on the format of the 
application being analyzed; column 9 lines 4-1 1 , figure 5) specifies at least one 
condition and the computer program (see application program in column 2 lines 58-61, 
column 3 lines 41-42) comprises code (see the object code of an application in figure 2 
[1 8, column 6 lines 1 5-21 ) adapted to verify for at least one of the objects (see the 
object code of an application in figure 2 [18, column 6 lines 15-21) of the relation path 
(see a unique path in column 14 lines 9-10) if said at least one object (see the object 
code of an application in figure 2 [18, column 6 lines 15-21) is in accordance with the at 
least one condition. 
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As to claim 16, Cline teaches the computer program (see application program in 
column 2 lines 58-61, column 3 lines 41-42) according to claim 13, wherein the 
computer program (see application program in column 2 lines 58-61, column 3 lines 41- 
42) comprises code (see the object code of an application in figure 2 [18, column 6 lines 
15-21) adapted to consider the existence of the relation path (see a unique path in 
column 1 4 lines 9-1 0) for obtaining of the policy (see a set of rules analyze the call 
based on the format of the application being analyzed; column 9 lines 4-1 1 , figure 5). 

As to claim 17, Cline teaches the computer program (see application program in 
column 2 lines 58-61, column 3 lines 41-42) according to claim 13, wherein the 
computer program (see application program in column 2 lines 58-61, column 3 lines 41- 
42) comprises code (see the object code of an application in figure 2 [18, column 6 lines 
15-21) adapted to obtain the at least one propagation rule (see a set of rules analyze 
the call based on the format of the application being analyzed; column 9 lines 4-1 1 , 
figure 5) from at least one propagation rule database (see a set of rules analyze the call 
based on the format of the application being analyzed; column 9 lines 4-1 1 , figure 5) on 
the base of at least one reference identifier (see "open addressing" hash table in column 
9 lines 15-19) associated to the at least one propagation rule (see a set of rules analyze 
the call based on the format of the application being analyzed; column 9 lines 4-1 1 , 
figure 5) and the policy (see a set of rules analyze the call based on the format of the 
application being analyzed; column 9 lines 4-1 1 , figure 5). 
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As to claim 18, Cline teaches the computer program (see application program in 
column 2 lines 58-61, column 3 lines 41-42) according to claim 13, wherein the 
computer program (see application program in column 2 lines 58-61, column 3 lines 41- 
42) comprises code (see the object code of an application in figure 2 [18, column 6 lines 
1 5-21 ) adapted to obtain at least one further policy component (see a set of rules 
analyze the call based on the format of the application being analyzed; column 9 lines 
4-1 1 , figure 5) of the policy (see a set of rules analyze the call based on the format of 
the application being analyzed; column 9 lines 4-1 1 , figure 5) from the at least one 
policy component database (see a set of rules analyze the call based on the format of 
the application being analyzed; column 9 lines 4-1 1 , figure 5) based on at least one 
reference identifier (see "open addressing" hash table in column 9 lines 15-19) 
associated to the at least one further policy component (see a set of rules analyze the 
call based on the format of the application being analyzed; column 9 lines 4-1 1 , figure 5) 
and the policy (see a set of rules analyze the call based on the format of the application 
being analyzed; column 9 lines 4-1 1 , figure 5). 

Conclusion 

The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

Schneier (US 5,850,51 6) is cited for the teaching of calculate the cost, time or 
probability of an attack to list the security assumptions of a system, to compare 
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competing systems, to evaluate system modifications, to perform security subsystem 
analysis, and to allocate a security budget. 

Reiter et al (US 6,049,872) is cited for the teaching of a Path Server for PGP, a 
service for finding maximum sets of such paths to support authentication in PGP-based 
applications. 

Juttner et al (US 2002/0045453) is cited for the teaching of controlling the trade- 
off between running time of the Lagrange algorithm and quality of the result. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to SUDHISH SURYAWANSI whose telephone number is 
(571 )270-7461 . The examiner can normally be reached on Monday - Friday 459. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Daniel Pan can be reached on 571-272-4172. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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Supervisory Patent Examiner, Art Unit 4171 



